FYI admins
cross-posted from: https://quokk.au/c/fediverse/p/1066667/tesseract-dev-injects-malicious-code-into-browser-to-illegally-ddos-the-dbzer0-instance
As part of the devs farewell message on their site, they have included malicious code to make each visitor sends 2,000 requests to the dbzer0 servers in an attempt to DDOS and take the instance offline.
57 Comments
cRazi_man@europe.pub · 82 pts · 27d
Gotta say, I've enjoyed this whole drama. This seems like the end of the story arc. It's been fun guys. Better than beans.
craftrabbit@lemmy.zip · 51 pts · 27d
Yeah, also this makes me really happy that we're on the fediverse. Turns out some part of the system is run by a strange control freak? Swiftly replace the part and everyone moves along.
KurtVonnegut@mander.xyz · 14 pts · 27d
Well said.
eldavi@lemmy.ml · 5 pts · 27d
only works for the ones lucky enough to catch it -- a tiny minority is likely considering that piefed was caught doing something similar and it's still on track to be one of the largest instances on the fediverse nonetheless.
magnetosphere@fedia.io · 22 pts · 27d
Agreed. I usually don’t care about online drama at all, but at least this has been… amusing.
db0@lemmy.dbzer0.com · 39 pts · 27d
The memes have been fresh!
magnetosphere@fedia.io · 21 pts · 27d
You deserve more credit. Thanks for bringing it to everyone’s attention!
sp3ctr4l@lemmy.dbzer0.com · 4 pts · 27d
The beans have certainly flowed, sheesh.
hamid@crazypeople.online · 5 pts · 26d
Nothing is better than beans, how dare you say that. The beans can hear you.
jerkface@lemmy.ca · 4 pts · 27d
I dunno, this opens the author up to a lot of consequences other people might choose to pursue.
vogi@piefed.social · 1 pts · 26d
Somebody has to jot it down for the "Rise and rise and rise of the fediverse"-Video in 20 years.
Aceticon@lemmy.dbzer0.com · 0 pts · 27d
Ironic Twist:
massacre@lemmy.world · 4 pts · 27d
"doubt"
wyldrstallyns@lemmy.dbzer0.com · 3 pts · 27d
X
Aceticon@lemmy.dbzer0.com · 2 pts · 27d
Me too.
It would surely be ironic, though.
Valmond@lemmy.dbzer0.com · 44 pts · 27d
What a loser. Tiny whiny loser.
Fabulous reaction time from db0 & team!
So who is this loser, I mean it's a tiny whiny bit illegal what he did it seems...
db0@lemmy.dbzer0.com MOD · 39 pts · 27d
dubvee.org is down
eldavi@lemmy.ml · 3 pts · 27d
what does dubvee.org have to do w it?
db0@lemmy.dbzer0.com · 13 pts · 27d
That's where the ddos originated
A404@lemmy.dbzer0.com · 36 pts · 27d
@db0@lemmy.dbzer0.com You need to see this
db0@lemmy.dbzer0.com · 65 pts · 27d
Already known and mitigated.
ggtdbz@lemmy.dbzer0.com · 13 pts · 27d
Not to expose anything that’s best left internal, but is this something the proof of work check handles? Is it something that’s been implemented in advance? Just curious, if you can talk about it at all. I’m woefully undereducated on the actual ins and outs of the web.
naught@sh.itjust.works · 9 pts · 27d
They can block requests from a specific origin or implement tailored rate limiting rules or disable CORS from that instance. Probably more too
unwarlikeExtortion@lemmy.ml · 10 pts · 27d
The problem is that this is a client side javascript-based attack - meaning your browser sends these malicious requests. So a DDOS, not "just" a regular (centralized) DOS. Anyone opening the page with javascript turned on (which is 99% of real users, however for Lemmy the statistic's surely a bit better) is an "attacker".
You can - once you know of the nature of the attack (this one's relatively simplistic), just react to any realistic-looking request and
blockignore the malicious ones - in this case garbled rng output.Rate limiting would only lead to what the attacker wants - legit users (who are unknowingly sending these malicious requests) being blocked from accessing the site.
db0@lemmy.dbzer0.com · 4 pts · 27d
For this kind of stuff you can easily ask an llm and it will give you a pretty decent rundown of mitigation tactics
ggtdbz@lemmy.dbzer0.com · 3 pts · 27d
Just thought it would be the cherry on top if this final outburst was automatically blocked by a mitigation measure that was already there.
Wobble@lemmy.dbzer0.com · 2 pts · 26d
I am not sure what the other preventative actions have been taken. Is it feasible to defederate from this and any other instance that is administered from this person who has virtually attacked the flotilla?
harrys_balzac@lemmy.dbzer0.com · 2 pts · 26d
The website has been taken down so that particular vector has been removed. The related startrek.website instance defederated from db0 and other instances have defederated from st.w due to all this.
The individual had at least 2 known alt accounts, so it's likely they have more and will pop back up like a noxious weed.
adam_y@lemmy.world · 29 pts · 27d
TrickDacy@lemmy.world · 12 pts · 27d
I'd gather that he is a massive control freak. Hard to feel sorry for him right now really but I agree it must be a sad life.
jerkface@lemmy.ca · 12 pts · 27d
why body shame
adam_y@lemmy.world · 5 pts · 27d
atomicbocks@sh.itjust.works · 0 pts · 27d
Yeah, tiny dick is an attitude not limited to penis havers nor defined by penis size so we say “main character syndrome”.
adam_y@lemmy.world · 3 pts · 27d
Aceticon@lemmy.dbzer0.com · 4 pts · 27d
Sometimes the kind of crap done by people who are selfish wankers is just that - crap - not a cry for help.
Certainly in my personal experience people who haven't actually grown up as persons to become mature adults don't actually see the problems that they repeateadly get into with everybody else because of having the emotional complexity and impulse control of toddlers as their fault, but rather as the fault of others.
There's no cry for help in their actions because they don't think they need help.
FundMECFS@piefed.zip · 2 pts · 27d
I dunno the dev has made loads of posts in the past year saying they’ll quit lemmy and tesseract only to come back. Clearly they were struggling and finding threadiverse wasnt helping but couldn’t stop coming back…
Feels like crisis/cry for help behaviour to me. Especially since they spent their first couple years on fedi being opinionated but generally polite and contributing compared to… whatever the fuck happened past couple months…
minty@aussie.zone · 28 pts · 27d
Wow lmao. This is crazy levels of petty
Abyssian@lemmy.world · 24 pts · 27d
"Tesseract dev found to have world's smallest and most rancid penis."
Telemachus93@slrpnk.net · 21 pts · 27d
What the actual fuck? This idiot may have his braindead opinions and do to his OSS project whatever he wants (so sag I wasn't on the list), but that is just such a fucked up thing to do.
Draconic_NEO@lemmy.dbzer0.com · 19 pts · 27d
It just gets worse and worse. I figured that the goodbye message he posted wouldn't be the end of it. Thankfully it seems to be down now so it's not causing harm anymore directly but still.
Rocketpoweredgorilla@lemmy.ca · 17 pts · 27d
This whole thing reminds me of the guy (Angled/LMAO) 3 years ago that was all butthurt after he got busted trying to take all the good sublemmy names, and responded by posting a bunch of disgusting stuff with alts and DOSing lemmy.world.
Edit https://lemmy.world/post/1720870
ChicoSuave@lemmy.world · 4 pts · 27d
This was a blast from the past.
OwOarchist@pawb.social · 13 pts · 27d
I wonder if you could actually track him down and prosecute him for it...
wiccan2@thelemmy.club · 20 pts · 27d
The domain seems to be registered to SquareSpace so his details are hidden from public view but there is a SquareSpace abuse email and US phone number.
I suspect in the first instance if db0 complained to them the site would be shutdown and SquareSpace would then have to comply with any legal action.
INAL but I strongly suspect that the DDOS would constitute a crime in the US where the domain is registered.
Taleya@aussie.zone · 7 pts · 27d
Nah he's hosted on inmotion. I already bipped 'em
wiccan2@thelemmy.club · 11 pts · 27d
The domain is registered to SquareSpace: https://who.is/whois/dubvee.org
The IP associated with the domain points to Inmotion: https://who.is/whois-ip/ip-address/107.161.30.39
Looks like both are true, hopefully Inmotion will take appropriate action based on your report. Worthwhile reporting to SquareSpace too so he can't just rehost an attack elsewhere.
Taleya@aussie.zone · 17 pts · 27d
Registrar and hosting are different things.
Registrar is who you bought and manage the domain name you use on your site through. Hosting is where it lives.
Most domain name registrars do not give a single shit what you do with a domain name, unless they're somehow on the hook. Hosting on the other hand.....
wiccan2@thelemmy.club · 6 pts · 27d
I understand how it works.
All I'm saying is the registrar should also be notified otherwise the site can be moved to another hosting platform.
If the registrar can be convinced to take action, at least the domain can't be used for future attacks.
Draconic_NEO@lemmy.dbzer0.com · 4 pts · 26d
Check startrek.website too. They defederated us immediately after banning someone who claimed to be an alt of Admiral Patrick. If their domain is less protected we might be able to bring him to justice over this.
SpikesOtherDog@ani.social · 6 pts · 27d
Yup. Anyone knowingly assisting would also be implicated. Afaik, the precedent was set about 20 years ago with the whole LOIC/anonymous ddos.
20cello@lemmy.world · 9 pts · 27d
Idk what this tesseract is and at this point I'm too afraid to ask
cRazi_man@europe.pub · 15 pts · 27d
I wrote a quick and dirty summary for someone else.
20cello@lemmy.world · 6 pts · 27d
Thanks mate
SCmSTR@lemmy.blahaj.zone · 6 pts · 27d
Actual lmao
naevaTheRat@lemmy.dbzer0.com · 5 pts · 26d
Isn't that like seriously criminal in the usa lol?
veniasilente@lemmy.dbzer0.com · 3 pts · 27d
Blegh. I made some effort to get to this instance and I'm not even on the list!
picnic@lemmy.dbzer0.com · 2 pts · 27d
@db0@lemmy.dbzer0.com is Tesseract the default UI for db0? I see voyager, photon and alexandrite listed on the front page but no mention on tesseract.
db0@lemmy.dbzer0.com · 7 pts · 27d
No it isn't. It's still there but I removed the link to it
picnic@lemmy.dbzer0.com · 2 pts · 27d
Thanks
hamid@crazypeople.online · 2 pts · 26d
Yanks gonna yank